CVE-2026-82856: @hulumi/policies GitHub OIDC Trust Policy Bypass

Overview

A critical access-control flaw has been disclosed in @hulumi/policies, allowing attackers to bypass mandatory guardrails on GitHub Actions OIDC trust policies. Tracked as CVE-2026-82856, the vulnerability arises because the policy engine only validated exact-match AWS IAM condition operators (StringLike/StringEquals), missing set-qualified variants like ForAnyValue:StringLike — which attackers can use to hide overly permissive, wildcard sub conditions from the required guardrail.

This is one of several related critical advisories published the same day across the hulumi package family — see CVE-2026-82855 and CVE-2026-82857.

Technical Details

How It Works

The G_OIDC_1 guardrail in @hulumi/policies is designed to catch AWS IAM trust policies that grant GitHub Actions OIDC federation access using an unsafe wildcard sub (subject) condition — for example, a trust policy that would allow any repository or branch in an organization to assume a role.

Before 1.3.2, the guardrail's inspector only checked for wildcard conditions expressed with the standard StringLike/StringEquals operator keys. AWS IAM also supports set-qualified operator variants — such as ForAnyValue:StringLike — that apply the same matching logic to a list of values. Because the inspector didn't account for these set-qualified forms, a trust policy author could write a condition using ForAnyValue:StringLike with a wildcard sub value, and the guardrail would fail to flag it as unsafe — even though the resulting trust policy is just as permissive as the pattern the guardrail was built to block.

Impact Assessment

Who Is At Risk

Organizations using @hulumi/policies (before 1.3.2) to gate AWS IAM trust policies for GitHub Actions OIDC federation are affected — particularly those relying on the G_OIDC_1 guardrail as their primary defense against overly broad CI/CD role-assumption permissions.

Potential Attack Chain

1. Crafted Trust Policy — an attacker (or malicious PR) writes an IAM trust policy using a ForAnyValue:StringLike condition with a wildcard sub value
2. Guardrail Bypass — the policy passes the G_OIDC_1 check because the inspector doesn't recognize the set-qualified operator
3. Broad OIDC Federation — any GitHub Actions workflow in the organization (or beyond, depending on the wildcard scope) can now assume the AWS role
4. Cloud Account Compromise — a compromised or malicious workflow in an unrelated repository can pivot into the AWS account via the over-permissioned role

Mitigation

Immediate Actions

• Upgrade @hulumi/policies to 1.3.2 or later, which evaluates set-qualified string operators and correctly rejects unsafe GitHub OIDC sub conditions
• Manually audit existing IAM trust policies for GitHub OIDC roles, specifically searching for ForAnyValue:StringLike or other set-qualified operators combined with wildcard sub values
• Tighten sub conditions to reference specific repositories, branches, or environments rather than relying on the guardrail alone

Detection Opportunities

• Search CloudTrail and IAM policy exports for trust policies containing ForAnyValue:StringLike alongside token.actions.githubusercontent.com conditions
• Flag any OIDC-federated role whose sub condition resolves to a broad wildcard match

Related Advisories

Part of the same disclosure batch as CVE-2026-82855 (evidence validation bypass) and CVE-2026-82857 (IAM privilege escalation), plus CVE-2026-82858 through CVE-2026-82863 across the wider hulumi package family — all resolved in the 1.3.2 release line.

References

• GitLab Advisory Database — GHSA-q2f7-m237-v562
• OffSeq Threat Radar — CVE-2026-82856
• NVD — CVE-2026-82856